Chrome DevTools MCP: Safe Setup & Security Grade (2026)

Q: Chrome DevTools MCP vs Playwright MCP: which should I use?

Use Chrome DevTools MCP to debug and measure: performance traces, network and console inspection, in Chrome. Use Playwright MCP to automate: clicking through flows and testing across browsers. Both grade C for the same reason (no auth, scripts by default), and both are much safer with an isolated profile. See the Playwright MCP guide.

Q: Can I use my existing Chrome with my logins?

Yes, with --browserUrl or --autoConnect. That's exactly the setup where the JavaScript risk matters most. Prefer --isolated unless the task really needs your session.

On this page

Chrome DevTools MCP Server: Setup, Safe Flags and Why It Grades C (Oct 2026)

The Chrome DevTools MCP server is Google's official server that lets an agent drive and debug a real Chrome: performance traces, network requests, console, screenshots and scripts. TrustedMCP grades it C. It's well maintained, but by default the model can run any JavaScript in a browser with your logins. Start it with --isolated and turn off JavaScript evaluation unless you need it.

What Chrome DevTools MCP does

The server starts (or connects to) a Chrome browser and exposes DevTools features as MCP tools: navigating pages, taking screenshots, reading console and network activity, recording performance traces, and running scripts in the page.

Its own README is blunt about the trade-off: the server "exposes content of the browser instance to the MCP clients allowing them to inspect, debug, and modify any data in the browser or DevTools."

How to install Chrome DevTools MCP (Claude Code, Cursor, VS Code)

These snippets come from the chrome-devtools-mcp README.

Standard config (Claude Desktop, Cursor and other JSON-config clients):

{
  "mcpServers": {
    "chrome-devtools": {
      "command": "npx",
      "args": ["-y", "chrome-devtools-mcp@latest"]
    }
  }
}

Claude Code with claude mcp add (--scope user makes it available in all your projects):

claude mcp add chrome-devtools --scope user npx chrome-devtools-mcp@latest

Or install it as a Claude Code plugin:

/plugin marketplace add ChromeDevTools/chrome-devtools-mcp
/plugin install chrome-devtools-mcp@chrome-devtools-plugins

VS Code from the command line:

code --add-mcp '{"name":"io.github.ChromeDevTools/chrome-devtools-mcp","command":"npx","args":["-y","chrome-devtools-mcp"],"env":{}}'

Whichever client you use, add the flags from the next section before you point it at anything that matters.

The safer setup: recommended flags

These options are documented in the project's configuration guide. Add them to the args array after chrome-devtools-mcp@latest.

Option	What it does	Why use it
`--isolated`	"creates a temporary user-data-dir that is automatically cleaned up after the browser is closed"	The browser doesn't carry your cookies and logins
`--javascriptEvaluation` set to false	"disable the server entry points for evaluating caller-provided JavaScript"	Removes the run-any-script risk if you only need traces, network and screenshots
`--allowedUrlPattern` / `--blockedUrlPattern`	Restricts the browser's network access to, or away from, URL patterns	Keeps the agent on the sites you're debugging
`--usageStatistics` and `--performanceCrux` set to false	Opt out of usage statistics, and of sending trace URLs to Google's CrUX API	Keeps your URLs and usage to yourself
`--headless`	Runs without a visible window	Fine for CI, but you can't watch what it does

To set a boolean option to false, use its negated form. The README shows this pattern with --no-usage-statistics. So, for example, add --no-javascript-evaluation and --no-performance-crux.

Watch out for --slim. It cuts the server down to three tools, but those are "navigation, script execution and screenshots". It doesn't remove the script risk.

Chrome DevTools MCP security risks

Arbitrary JavaScript by default. Unless you turn it off, the model can run any script in any page the browser has open. In a normal profile that means your logged-in sessions: email, cloud consoles, admin panels. Text on a web page can also try to steer the model into running something (prompt injection). That's why the server scores 0 on both authentication and transport in our rubric, the same as Playwright MCP.

Don't expose a debugging port. You can point the server at a Chrome you started yourself with --browserUrl (for example http://127.0.0.1:9222). A Chrome remote debugging port gives full control of that browser to anything that can reach it, and it has no password. Our advice: keep it on 127.0.0.1, never bind it to a network address, and use a separate profile for it.

No authentication. The server runs locally over stdio and trusts whatever client starts it. Only add it to clients and projects you control.

Advisories, all fixed. The project has published four advisories, all moderate, all fixed before they were published (advisories):

GHSA-5hw5-4q87-m6x9 / CVE-2026-106484 (22 Oct 2026): a symlink could send a tool's output file outside the allowed MCP roots. Affected 1.1.0 to 1.4.0, fixed in 1.5.0. It's covered in our October 2026 security roundup.
GHSA-xfxg-8r4q-wj4v (22 Oct 2026): fetches started by a service worker could bypass the URL allow and block lists.
GHSA-8qf9-62x2-82pp (16 Jun 2026): path validation didn't resolve symlinks before checking roots.
GHSA-3pvj-jv98-qhjq (15 Jun 2026): a daemon.pid write could follow symlinks in a /tmp fallback directory.

Run a current release. The @latest tag does that for you, but it also means every start can pull a new version. Pin a version if you want to review updates first.

Why it grades C

Authentication: 0 of 30. None, and the default lets the model run any JavaScript.
Maintenance: 25 of 25. First-party from the Chrome DevTools team, with releases almost every week.
Known CVEs: 25 of 25. Four advisories, all fixed before publication.
Transport: 0 of 20. It drives a real browser that can keep your logins and run arbitrary scripts on your machine.

With --isolated and JavaScript evaluation turned off, most of the risk goes away, but we grade the default setup. See the Chrome DevTools MCP listing and how TrustedMCP scores servers.

Frequently asked questions

Chrome DevTools MCP vs Playwright MCP: which should I use?

Use Chrome DevTools MCP to debug and measure: performance traces, network and console inspection, in Chrome. Use Playwright MCP to automate: clicking through flows and testing across browsers. Both grade C for the same reason (no auth, scripts by default), and both are much safer with an isolated profile. See the Playwright MCP guide.

Is Chrome DevTools MCP safe?

It's safe enough with the safer setup above: an isolated profile, JavaScript evaluation off unless needed, URL allow-lists, and tool approval on. With the defaults in your everyday profile, it isn't.

Does it send data to Google?

By default it sends usage statistics, and it sends URLs from performance traces to Google's CrUX API for field data. Turn both off with --no-usage-statistics and --no-performance-crux.

Can I use my existing Chrome with my logins?

Yes, with --browserUrl or --autoConnect. That's exactly the setup where the JavaScript risk matters most. Prefer --isolated unless the task really needs your session.

Is `--slim` safer?

Not for scripts. Slim mode keeps script execution as one of its three tools.

More: Is this MCP server safe to install? · MCP tool annotations explained · Browser automation category